894be96d5cbd135436f3ed560d45d1433c724d93b7f298872884a254235d38c7

Sharing

Copy URL Twitter E-mail

General

Target
IMobie DroidKit 2.3.9.20260727-amped.rar
Size 323.4MB
Sample260820-snpk8seb63
SHA256 894be96d5cbd135436f3ed560d45d1433c724d93b7f298872884a254235d38c7
MD5 77ca43f09f95fee6daf23b844d01c1a4
SHA1 8826f9a7823fb832c198c04e70fa0553a098e44a
SHA512 9dad0ecad3a7aad461dae872ac1ea100aea4fceeabbabf5453e8a4a29357317ad42239ce833b4aaa5fa087265f443a9f2cab796880b1903e57811426adc43bd3
SSDEEP 6291456:W+cOgSP59MX7VXYnPVyqb5Bo/zqp0cahpuaUt/J1uAfpSqyKKvzg/CcxrgRURN:WJlSP59MrVoPV/NBbIpuxt/J1uAhS7dq
TLSH
T104F833412537A6B2CF28BE426E22338D6B397261E7A5D476FC094FC9AB354FB243514C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  IMobie DroidKit 2.3.9.20260727-amped.rar
- Size 323.4MB
- SHA256 894be96d5cbd135436f3ed560d45d1433c724d93b7f298872884a254235d38c7
- MD5 77ca43f09f95fee6daf23b844d01c1a4
- SHA1 8826f9a7823fb832c198c04e70fa0553a098e44a
- SHA512 9dad0ecad3a7aad461dae872ac1ea100aea4fceeabbabf5453e8a4a29357317ad42239ce833b4aaa5fa087265f443a9f2cab796880b1903e57811426adc43bd3
- SSDEEP 6291456:W+cOgSP59MX7VXYnPVyqb5Bo/zqp0cahpuaUt/J1uAfpSqyKKvzg/CcxrgRURN:WJlSP59MrVoPV/NBbIpuxt/J1uAhS7dq
- TLSH
  T104F833412537A6B2CF28BE426E22338D6B397261E7A5D476FC094FC9AB354FB243514C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery installer themida
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  AppsURL QR.jpg
- Size 49KB
- SHA256 96e21d200f48bc20406924f51539ed0fa71af679d7e5e34581ffa95619dcc109
- MD5 bf04bfa709c63904914f4a61a4b1a2e5
- SHA1 bf3f5dc1be6d6348f928fd37f43903205744b5b6
- SHA512 9f57d03a46bf9a7fc7804b2975fb8c941287556c530943a4840da4319930f605708e09ffd24a6bae53e11e4ea70eb7a69c595b7e731a788798cbb79ebb2a5202
- SSDEEP 768:S8HoAUyIiD13sN5GBjzkFU1K0PUTXA5IaR9g31lZx61siYS99J3Lftp7UQbp84zW:S8Ho6D2N5ijHK0PyPyi1l3MznAQnW
- TLSH
  T1623302FA30B67A0FF07EE7B11563FD840312BBAB450F36AA2203765FDD495265636842
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Attention.txt
- Size 3KB
- SHA256 674dc14e05ddda613a97f8097fa4225b0001ec7b3a5b0403816b0b6872fcda71
- MD5 398a33d9c54d2c9c46d4b1cecccb88f4
- SHA1 71031d5114c6e561b72274a6e2213c2ba9aa9b18
- SHA512 fa0ca4a81723dd9d3a9b6baeb9b07dff9cd909a80f74a49a5079bf3e41d0b6fe6dc31ca2c672c449e2d50ac20c46fcb880d9a6a21a1c94470f1a2b2484662c0a
- TLSH
  T1D4612D127BEC1D12BAB63E51197DD0A0066B7DC65838CF991738304C85EEF749BA2B63
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral3
- Target
  Download More.url
- Size 122B
- SHA256 45eacd3e6cb034cc63b8c23a5d430ce2fc096e584dde6d85edef9e8bbf6b07b2
- MD5 850a1ecd29f3438c5d77474d4b04c6db
- SHA1 20e5f8db6226fbddfcb1f29d0668dbf454e55bab
- SHA512 592c5a4154c3dbdbb4c6918f5b1b689bf470e37186d1677dff49c0c536852c9467f68439643b22980db741ec78bccb56167b386b428ff64cba71182aed4ab7aa
- TLSH
  T1A1B012AE8246828BD351950AB0F0F9099E0FBDA40CD2D09CBA58DEDB0C880D3C948B36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral4
- Target
  Join Telegram for more.url
- Size 130B
- SHA256 aa92b284c31d842ccb9dd8b1b515f22fb70d7b69387d85f42884a711d60d23c2
- MD5 54e39957b019fc7c1d2b005ca23f759c
- SHA1 b76214cc619139a076594fba6048aedfa4754cbf
- SHA512 902eb84dd12397ef4be22ba9eb240f59aa9bbc4091512d3987893ea57b59c2a82e9f433cd7f6f710945e4accd9ecc891c7de127ca3a5231b18bedbdb5be84650
- TLSH
  T166C02B7F4202C245C241C0051070FC08444E78B809D1D00C1508CF870C880C0C004F35
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5
- Target
  Join Telegram.png
- Size 94KB
- SHA256 66454aa2cdd94e05c4ac259b2253d743a04ccfe2c1bddc2aa11be51d08122e82
- MD5 1c2a7829203b5a0a0b6c6f67d967bb21
- SHA1 f01b3d3a726d19321c1997f1ac073dda474fffb1
- SHA512 f515a3e834dd914d0c0df5971af1b96bf83db29bcb0bc6276575711cc16463aafb8b37e739e51aee1aafc5e0d46ef36f4d80975557302ea62a1d0f002bd9ab62
- SSDEEP 1536:tu9WKzlVao1l3PwM4V1iPdvsQT1vXf1XCMjSIBiYZkV3zP5DG+Q9JWb1O:tulQk3PbdbVyMjHJZkV3zPshJp
- TLSH
  T17B9302BC6C1F8ACEC13ED639C79CA83949C979E240B24E25256BB03D5F457B49618F0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  patch-AMPED.zip
- Size 3.2MB
- SHA256 cf13ba24de378039f39eedee30803b1e1a8d95d76908ebb947c7b9dd3c6574d5
- MD5 3e417a835e3393a663ab0e311b03e3c6
- SHA1 85b22a7dc22b2475f5bc992fd4b80b882c5370f1
- SHA512 4d821df4ea01dc4a31224de93450bfb183b06443587179befb679d12d4fdb68a0cf79e802de783ddc1e98e47468ad922051e7e80013b07cbef24b1f0e5978a51
- SSDEEP 98304:O3ttVv87uoHeYKWZsx/2WeHLzBSoAFbZWpvXAf:GtPcuoHRZC/2lBSoANZAvXAf
- TLSH
  T114F533926D217E68DEE09CF3D396E95891549416C3B94B06BE9E13FCCF303A46D3680B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  AMPED/AMPED.txt
- Size 297B
- SHA256 0d21dfabc2144f592e8e15215d2f7f5755becb731dd0b0b87d9b2e21c06f2903
- MD5 4e53f5e02f8e261397b13ca7e89fdae0
- SHA1 88a1e6a79031f8794ce32d26dc14e7327a89a015
- SHA512 e667b7bf8d05e5b7ba46eb96351484d79f3be2d56b5053ec1ed7c93d00c247a6ac6090965ddaba7eb79e013e6e55d48e90520cd11fa847f0107c8992ee247cc7
- TLSH
  T165E0EB0F4CF523C25102C62C37AF1C328521C10DE32081AA89779020637C27EB073EC3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral8
- Target
  AMPED/patch.exe
- Size 3.2MB
- SHA256 557031775f6e882df70f077c78819a3266fe3dd629baabeb83b01e2cd84d27d3
- MD5 74c151b272c5c2ace7de16232a36d733
- SHA1 2a5ea6d25d29559d98e8ee697c7473d5dfb25881
- SHA512 57d29eacd5460267b2b41d0d4cdb83e2da09f69ed68853e18863731a92bc4e0b2759ebff897a36907ce21795645af1a6e3891ebd6b16901fc9eff94499546c02
- SSDEEP 98304:e3ttVv87uoHeYKWZsx/2WeHLzBSoAFbZWpvXAb:2tPcuoHRZC/2lBSoANZAvXAb
- TLSH
  T105F533A26D217F78DCD49CF393A6E95881549856C3B94B06AEDD13FCCD303A86D3680B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral9
- Target
  amped.nfo
- Size 4KB
- SHA256 1928634e3a367e8a45fdc21fd3c39c93dcefa25519de104dfe5eb11ede2dd0a3
- MD5 ba211ed767e17e06bb594aba39fcbab7
- SHA1 60248ea7999d4b616354b2ee0ae8324b2b2a94b8
- SHA512 4e60f130f6aab6f0f1ec1a10d337b80b299af54a4c50696e31e6f041cee9cf9a24b47288456ac4dea48696b7086098397ec50509aa9eda020e116f287ef7a770
- SSDEEP 48:xG6fjX7BEpXoviLcKSOiMb/ZJO1cO5sYjTm/:xNX7BEmWcKSOiMb/2WOXTm/
- TLSH
  T185918A07A23286FE2732DA20D656E154E3A6403F47742EB5302F9B26BB77F76135C211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  file_id.diz
- Size 308B
- SHA256 0598158341e480fa16433204ebc40d3cf39184d566a784415e429f646ca41fb6
- MD5 f188fc419020371209be8cc51dafe594
- SHA1 79a6407896c53c0da7f2f6f0ce4680e6ef465323
- SHA512 f15334eb7eed22ff209409c83781a2fea03741db53a982025932ede43ce4dbf62123a7539e69e1ea903f19fcbbfd20e6de3c1845967d32d35ead06ea4aacd780
- TLSH
  T1E1E05EE41044D4868F3A22F0AB87F63C51DA16560266C4F2731D2BE8D3A638264C104F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  setup.exe
- Size 329.6MB
- SHA256 0656cb12cd8c37326834f047827372c6b69f3d2a4eab3e2fd35e485eda2df2e2
- MD5 a67fa1e6baf2a17b0f6b18628f71a685
- SHA1 1eb1e1d2d9a30774ef782e66e5579ade6e1fbe8b
- SHA512 dc0b7b0106e8dc9163efc98a97827f522342bb5028555f3c58520dc47fc8da8af486bb8937d10346a301fd1ddab7fe28c0df75c5420f3a135f88ab6f5818b07d
- SSDEEP 6291456:kR6/eGUdfZk887ycdxcpCg2UFiJ45/0PbPbiLgubMtu9:HGGUdd8Z7UK450zPsgu/9
- TLSH
  T1F1F833BBF1D9854BF03E93396AB53C6146F64721A2B2041E18DE622CDB66FE35D3D402
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Themida packer

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12